How to track down which publication sends user-related data?

waldgeist · February 4, 2017, 12:46pm

I am using fastrender to speed up startup times. One user of my app recently complained that sensitive information can be found in the source code of each page. I first could not believe that but then found out that the e-mail address is included in fastrender`s injected data.

Since I was sure I wasn’t publishing this part of the user document myself, I tried to track down which publication was responsible for publishing the e-mail address. I found out that okgrow:analytics has a pub that publishes all e-mails it can get to the client, including those of social networks.

I disabled the package and some of the data injected for okgrow:analytics went away. But still, the emails portion of the user document can be found in the injected code. I could not find any other publication causing this.

Is there a way to track down data that has been sent to the client, e.g. by inspecting the LiveData data structures?

Edit: I now found the real “culprit” for the emails publication:

github.com

meteor/meteor/blob/f1f29d2e1325b1193d25ff5c9a4c0b63d0a4a8b2/packages/accounts-base/accounts_server.js#L1035




///
/// PUBLISHING DATA
///


// Publish the current user's record to the client.
Meteor.publish(null, function() {
if (this.userId) {
  return Meteor.users.find(
    {_id: this.userId},
    {fields: {profile: 1, username: 1, emails: 1}});
} else {
  return null;
}
}, /*suppress autopublish warning*/{is_auto: true});


// If autopublish is on, publish these user fields. Login service
// packages (eg accounts-google) add to these by calling
// Accounts.addAutopublishFields Notably, this isn't implemented with
// multiple publishes since DDP only merges only across top-level
// fields, not subfields (such as 'services.facebook.accessToken')

Does anybody know why Meteor discloses the email to the client?

I also found this article: https://meteorhacks.com/instant-login-for-meteor-with-fast-render/. Obviously, the fact that FastRender auto-injects user data was meant as a “feature”.

(Still wondering how I could detect such a publication quicker, so I leave the question open.)

copleykj · February 4, 2017, 11:32pm

The publication for the logged in user publishes their email. Since it’s their email address and it’s only published to them it’s assumed not to be sensitive.

copleykj · February 4, 2017, 11:33pm

As far as tracking which publication, I’m not currently aware of any way to accomplish this.